You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
tailscale/ipn/ipnlocal
Tom DNetto f1ab11e961 ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths
Previously, `TAILSCALE_USE_WIP_CODE` was needed to hit a bunch of the TKA paths. With
this change:

 - Enablement codepaths (NetworkLockInit) and initialization codepaths (tkaBootstrapFromGenesisLocked via tkaSyncIfNeeded)
   require either the WIP envknob or CapabilityTailnetLockAlpha.
 - Normal operation codepaths (tkaSyncIfNeeded, tkaFilterNetmapLocked) require TKA to be initialized, or either-or the
   envknob / capability.
 - Auxillary commands (ie: changing tka keys) require TKA to be initialized.

The end result is that it shouldn't be possible to initialize TKA (or subsequently use any of its features) without being
sent the capability or setting the envknob on tailscaled yourself.

I've also pulled out a bunch of unnecessary checks for CanSupportNetworkLock().

Signed-off-by: Tom DNetto <tom@tailscale.com>
2 years ago
..
c2n.go wgengine/magicsock: make debug-level stuff not logged by default 2 years ago
cert.go ipn/{ipnlocal,localapi}: move most of cert.go to ipnlocal 2 years ago
cert_js.go ipn/ipnlocal, wgengine/netstack: start handling ports for future serving 2 years ago
cert_test.go ipn/{ipnlocal,localapi}: move most of cert.go to ipnlocal 2 years ago
dnsconfig_test.go ipn/ipnlocal: use ipn.PrefsView 2 years ago
local.go ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths 2 years ago
local_test.go ipn: remove unused Backend interface 2 years ago
loglines_test.go ipn/ipnlocal: add support for multiple user profiles 2 years ago
network-lock.go ipn/ipnlocal,tailcfg: introduce capability to gate TKA init paths 2 years ago
network-lock_test.go cmd/tailscale,ipn: store disallowed TKA's in prefs, lock local-disable 2 years ago
peerapi.go envknob: add CanTaildrop (TS_DISABLE_TAILDROP) to disable taildrop on device 2 years ago
peerapi_h2c.go all: remove old +build tags 2 years ago
peerapi_macios_ext.go all: remove old +build tags 2 years ago
peerapi_test.go ipn/ipnlocal: move selfNode from peerAPIServer to peerAPIHandler 2 years ago
profiles.go ipn/ipnlocal: account for ControlURL when merging profiles 2 years ago
profiles_test.go ipn/ipnlocal: account for ControlURL when merging profiles 2 years ago
serve.go cmd/tailscale/cli: flesh out serve CLI and tests (#6304) 2 years ago
serve_test.go ipn/ipnlocal: support serving files/directories too 2 years ago
ssh.go ssh/tailssh: add Tailscale SSH (server) support on FreeBSD 2 years ago
ssh_stub.go ssh/tailssh: add Tailscale SSH (server) support on FreeBSD 2 years ago
ssh_test.go ipn/ipnlocal: add support for multiple user profiles 2 years ago
state_test.go ipn,types/persist: add DisallowedTKAStateIDs, refactor as view type 2 years ago